Password Generator: strong random passwords and passphrases

Type
of 100

Passwords are made in your browser and never sent anywhere. Nothing is stored or logged, and the page does not remember what you generate.

About Password Generator

This tool creates strong passwords and passphrases in your browser. Choose random characters for the most strength per character, or a passphrase of random words that is easier to type and remember.

Set the length from 4 to 128 characters, pick which kinds of characters to use, drop look-alike characters, and make up to 100 at once. The strength meter estimates entropy in bits from your exact settings.

The randomness comes from the browser's secure random generator, and nothing is sent anywhere or stored.

How to use it

  1. Pick Random characters or Passphrase.
  2. Set the length or word count, and the character types or separator.
  3. Check the strength meter. Press Generate for a new one.
  4. Press Copy to put it on your clipboard, then paste it into your password manager.

Frequently asked questions

How are the passwords generated?

Every character and word is picked with your browser's secure random generator (crypto.getRandomValues), the same source used for cryptographic keys. To avoid favouring some characters over others, values that would skew the result are discarded and redrawn (rejection sampling), so each option is equally likely.

What is entropy and how many bits do I need?

Entropy measures how many guesses an attacker would need, in bits: each extra bit doubles the work. Under 40 bits can fall quickly to offline cracking, 60 to 80 bits is good for most accounts, and 80 or more is very hard to break. A 20 character password with all four character types is about 130 bits.

Random characters or a passphrase?

Random characters pack the most strength into the fewest characters, which suits a password manager. A passphrase such as correct-horse-battery is easier to type and remember. Five words from the 7,772 word list is about 64 bits and six words is about 77 bits.

Where does the word list come from?

The EFF Large Wordlist for random passphrases, 7,776 words chosen by the Electronic Frontier Foundation to be easy to read and spell, licensed CC BY 3.0 US. The four words that contain a hyphen are removed, leaving 7,772. It loads only when you switch to passphrase mode.

What does exclude look-alikes do?

It removes characters that are easy to misread when you copy a password by eye: I, l, 1, O, 0 and o. This slightly shrinks the pool, and the entropy figure accounts for it.

Is anything sent to a server or saved?

No. Passwords are generated on your device, nothing is uploaded, and nothing is stored in cookies or local storage. Only your settings (length, options) appear in the page address so you can bookmark them. The passwords themselves never do.